Devise 5.0

Apply the Ruby 4.0 and Ruby on Rails 8.1 baselines first. These rules cover Devise 5.0 with its standard Active Record and bcrypt integration, plus the boundaries of optional OmniAuth authentication; they were checked against 5.0.4. The gem's Ruby >= 2.7 and Rails >= 7.0 installation requirements do not make end-of-life runtimes suitable for deployment.

Modules, identity, and tenant boundaries

• Enable only required modules in each model and expose only their intended devise_for routes. Enable :confirmable, :lockable, and :timeoutable explicitly when needed; their configuration settings alone do not activate them.
• Remove public registration routes for closed enrollment. Keep :registerable declared if retaining RegistrationsController edit/update actions, because those actions use its model configuration in Devise 5.
• Protect each scope with its matching helper, such as authenticate_admin! for administrative controllers. An unscoped signed_in? can succeed for a different Devise model and does not establish the required identity or authorization.
• Use authenticate_user!(force: true) or the corresponding scoped helper for protected actions added to a DeviseController subclass; these authentication helpers normally skip enforcement inside Devise controllers.
• Implement suspension and eligibility checks through active_for_authentication? using super && application_condition; preserve Warden's activatable hook so confirmation and lockout checks also run when loading existing sessions.
• Recheck tenant membership on every protected request.